splunk monitoring log watching
clean up